A study on classification of the security controls for the effective implementation to nuclear power plant
2
조회
0
다운로드
0
인용
0
참고문헌
키워드
초록
As regulatory bodies require full implementation of security controls in nuclear power plants (NPPs),security functions for critical digital assets are currently being developed. For the ultimate introductionof security controls, not alternative measures, it is important to understand the relationship betweenpossible cyber threats to NPPs and security controls to prevent them. To address the effectiveness of thesecurity control implementation, this study investigated the types of cyber threats that can be preventedwhen the security controls are implemented through the mapping of the reorganized security controls inRS-015 to cyber threats on NPPs. Through this work, the cyber threat that each security control canprevent was confirmed, and the effectiveness of several strategies for implementing the security controlswere compared. This study will be a useful reference for utilities or researchers who cannot use design basis threat(DBT) directly and be helpful when introducing security controls to NPPs that do not have actual securityfunctions
Abstract
As regulatory bodies require full implementation of security controls in nuclear power plants (NPPs),security functions for critical digital assets are currently being developed. For the ultimate introductionof security controls, not alternative measures, it is important to understand the relationship betweenpossible cyber threats to NPPs and security controls to prevent them. To address the effectiveness of thesecurity control implementation, this study investigated the types of cyber threats that can be preventedwhen the security controls are implemented through the mapping of the reorganized security controls inRS-015 to cyber threats on NPPs. Through this work, the cyber threat that each security control canprevent was confirmed, and the effectiveness of several strategies for implementing the security controlswere compared. This study will be a useful reference for utilities or researchers who cannot use design basis threat(DBT) directly and be helpful when introducing security controls to NPPs that do not have actual securityfunctions
참고문헌 (32)
- Burns, D. Robert, "WASH 1400-reactor safety study", Prog. Nucl. Energy, 6(1-3), pp.117~140 (1980)[DOI]
- Less Well Known Cases of Nuclear Terrorism and Nuclear Diversion in Russia, "William C. Potter", NTI, ~ (1997)
- Ted G. Lewis, "Critical Infrastructure Protection in Homeland Security:Defending a Networked Nation" (2019), John Wiley & Sons
- W32. Stuxnet dossier, "Nicolas Falliere", Symantec Corp, 29~, pp.White Paper, 6 (2011)
- "Stuxnet malware and Natanz" (2011)[URL]
- "Monju power plant facility PC infected with virus" (2014)[URL]
- T.D. Maiziere, "Die lage der it-sicherheit in deutschland 2014", Bundesamt für Sicherheit in der Informationstechnik, ~ (2014)
- "German Nuclear Plant Infected with Computer Viruses, Operator Says"[URL]
- "Top 10 web application security risks, open web application security project" (2019)[URL]
- "The STRIDE threat model, microsoft" (2009)[URL]
- Christopher Alberts, "Introduction to the OCTAVE Approach", pp.2003
- "Common Vulnerability Scoring System, V3 development update" (2015)[URL]
- "Cybersecurity Risks, National Institute of standards and technology" (2015)[URL]
- Cynthia Phillips, "A graph-based system for networkvulnerability analysis", Proceedings of the 1998 Workshop on New Security Paradigms (1998)
- Sheung Yin Kevin Mo, "Beling, Kenneth G", 2009 Systems and Information Engineering Design Symposium, IEEE (2009)
- Silvia Tolo, "Nuclear Facilities and Cyber Threats", ~ (2019)
- Rafiullah Khan, "STRIDE-based threat modeling for cyber-physical systems", 2017 IEEE PES Innovative Smart Grid Technologies Conference Europe (ISGT-Europe) (2017), IEEE
- Assessment of Cyber Security Challenges in Nuclear Power Plants Security Incidents, Threats, and Initiatives, "Rahat. Masood", Cybersecurity and Privacy Research Institute the George Washington University, ~ (2016)
- Woogeun Ahn, "Development of cyber-attack scenarios for nuclear power plants using scenario graphs", Int. J. Distributed Sens. Netw, 11(9), pp.836258~ (2015)
- I. Lee, "An Analysis of Cyber-Attack on NPP Considering Physical Impact", Korean Nuclear Society Spring Meeting (2016)
- 김승민, "Cyber attack taxonomy for digital environment in nuclear power plants", Nuclear Engineering and Technology, 52(5), pp.995~1001 (2020), 한국원자력학회[DOI]
- "Regulations (NRC, 10 CFR)" (2021)[URL]
- "Enforcement Decree of the act on physical protection and radiological emergency, Presidential Decree No. 28211" (2017)[URL]
- "Development, Use and Maintenance of the Design Basis Threat. IAEA. NSS. No.10-G", Development, Use and Maintenance of the Design Basis Threat, ~ (2009)
- Engineering safety aspects of the protection of nuclear power plants against sabotage: technical guidance, , IAEA, ~, pp.NSS. No 4 (2011)
- Cyber Security Programs for Nuclear Facilities. US Nuclear Regulatory Commission, "US Nuclear Regulatory Commission", Office of Nuclear Regulatory Research, ~ (2010)
- "Status of NRC licensees' implementation of cyber security plans", NRC, 2017, ~
- "KINAC", RS-015.01, Regulatory Standard on Cyber Security for Nuclear Facilities, 2016
- Hyundoo. Kim, "Study on the position enhancement for cyber security organization of the nuclear facilities", Proceedings of the Korean Radioactive Waste Society Conference (2017), Korean Radioactive Waste Society
- Y.D. Kang, "Nuclear I&C and Huma Factor Engineering from the Regulator Perspective", Nuclear Safety & Security Information Conference 2016 (2016), DCC
- Sang Min Han, "Development of Initiating Cyber Threat Scenarios and the Probabilities Based on Operating Experience Analysis", Transactions of the Korean Nuclear Society Spring Meeting (2020)
- Sang Min Han, "Suggestion of initiating threats and bounding groups for nuclear power plant cyber-risk assessment", Annals of DAAAM & Proceedings, 30 (2019)